CVE-2014-8881: Regular Expression Denial of Service in bleach All versions of the `bleach` package are vulnerable to a regular expression denial of service attack when…

medium

Regular Expression Denial of Service in bleach

All versions of the `bleach` package are vulnerable to a regular expression denial of service attack when certain types of input are passed into the sanitize function.


## Recommendation

The `bleach` package is not currently maintained, and has not seen an update since 2014.

To mitigate this issue, it is necessary to use an alternative module that is actively maintained and provides similar functionality. There are [multiple modules fitting this criteria available on npm.](https://www.npmjs.com/search?q=html%20sanitizer&page=1&ranking=optimal).

Affected

1 ranges

Vendor	Product	Version range	Fixed in
mozilla	bleach	>= 0.0.0	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.